Heap Out-of-Bounds Vulnerability in Tesseract Open Source OCR Engine

CVE-2026-73066

What is CVE-2026-73066?

Tesseract, the open-source optical character recognition (OCR) engine, has a vulnerability that arises when a specially crafted .traineddata LSTM model component is deserialized. This flaw can lead to an unchecked signed integer multiplication in the Convolve::DeSerialize function, resulting in a wrapped convolution output-channel count. As a consequence, the forward-pass output buffer may be undersized, potentially allowing heap out-of-bounds writes during OCR processing. This issue has been addressed in Tesseract version 5.5.3, ensuring better security against such incidents.

References